1. Field
The present invention relates generally to network security techniques, and more specifically to detecting characteristics of devices communicating in data networks employing wireless local area network (WLAN) technology.
2. Background
The Institute for Electrical and Electronic Engineers approved the “Standard For Information Technology; Telecommunications and information exchange between systems-Local and Metropolitan networks-Specific requirements; Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Higher speed Physical Layer (PHY) extension in the 2.4 GHz band” (known as 802.11b) for the development of products to allow computers and other devices to connect to wired Local Area Network (LAN) segments not with wires, but by using radio-based network interface cards (NICs) working in the public 2.4 GHz range. Such wireless access to a wired LAN is often referred to as a wireless network.
As a result of the 802.11 standard, many network products were developed that provide access points that are wired into a LAN segment and provide access to the network for the wireless client computers using these radio-based NICs. Because wireless connectivity can span outside the physical control of a building, the current physical security measures that attempt to prevent unauthorized access to a LAN are no longer effective. By using a Service Set Identifier (SSID), only those attempts to access the wireless network that use the same SSID on the client cards as is on the access point will connect. The SSID does not provide security, however, only identification. The SSID is sent in an unprotected fashion by both the access point and the clients, and can be easily captured and exploited.
Security measures were incorporated into the 802.11b protocol, including Wired Equivalent Privacy (WEP) data encryption and shared secret passwords. The shared secret passwords provide limited protection and are rarely used. WEP relies on a shared password used by the access point and the clients to encrypt the payload data of the transmission, but does not encrypt the header and other information about the communication. Further, WEP was developed before the export restrictions were lifted on encrypted algorithms. Because of this, WEP was only designed to use 40 bit keys and was not cryptographically complex. After the export restrictions were lifted, a 104-bit version was implemented. Unfortunately, this “stronger” version still used a flawed crypto implementation. It was not long before white papers were written describing how the WEP key could be broken. Soon after that, products appeared that could assist in breaking WEP.
The use of 802.11x wireless networks (where 802.11x refers to any of the 802.11 standards that define wireless protocols, including, for example, 802.11b and the recently released 802.11a) has grown significantly. This, coupled with the availability of low cost equipment in the consumer market, has raised many questions for IT department administrators about whether or not to implement a wireless network, and, if so, how to implement one. Many computer security policies likely preclude the utilization of any wireless network tied into the main network wiring. Others allow limited use for the convenience of their employees, but dictate strict security settings.
Contrasting this, certain industries necessitate the deployment of wireless networks. For instance, the sheer size and topology of an overnight package delivery company such as Federal Express requires the use of handheld wireless nodes in their day-to-day operations. Typically, most early wireless networks employed by companies such as this were proprietary. But due to the increase in available hardware and software, and due to the increased performance and ease to which 802.11x networks can be integrated into existing IT infrastructures, many companies such as Federal Express are switching to the commercially available systems.
In most situations, wireless breaches of wired networks go unnoticed. Unlike the plethora of security devices/services available for the wired network infrastructure few tools exist for the system administrator to detect wireless intrusions.
One security issue with wireless networks is the fact that it is inexpensive and easy to install a new wireless access point onto an existing wired network. This could open an otherwise secure network to outsiders. Many current wireless intrusion detection products work by monitoring the wired network for access points. This requires their use on every separate segment of the network, since each separate network segment would need to be monitored individually. Also, current solutions do not identify any client machines that are attempting to access the wireless LAN.
A second security issue involves locating wireless access devices (particularly unapproved ones) within a wireless network. A wireless access device can include any wireless device that can provide access to a network, including a wireless access point or wireless client. Traditionally, locating the source of radio signals, such as those emitted by a wireless access device, utilizes a TDF (Time/Distance Fix) approach that requires listening stations at known points in space, and the application of a timestamp and direction for a given radio transmission. This requires that all listening stations have directional antennas and highly accurate clocks that are synchronized to the other listening stations. These components of the solution are prohibitive in an office environment. Furthermore, the directional antennas are more expensive than their omni-directional counterparts. The use of directional antennas also implies that complete coverage of a given area can only be achieved with a greater number of listening stations than if omni-directional antennas where used. Lastly, the requirements for the accuracy and synchronization of the clocks increases as the range to the target decreases. Since an 802.11 wireless access device has a range of only several hundred feet, highly accurate and well-synchronized clocks are required, further increasing the expense of any potential solutions.
A third security issue involves early and accurate detection of possibly highly sophisticated network intrusions, such as spoofing. Traditional intrusion detection system (IDS) solutions attempt to capture and store network packets as quickly as possible for the purpose of attack detection, anomaly detection, and event correlation. This typically requires high bandwidth connections to the observed network, fast instruction processing, and large storage capacity.
When applied to wireless networks, the same problems exist. A traditional approach to intrusion detection involving 802.11 would require packets to be captured as quickly as a radio receiver could receive them. In addition, 802.11 networks operate on multiple channels, each of which must be observed separately. Thus, in order to observe all current 802.11b channels (of which there are 14), 14 different observing radios would be required. In addition to being cost prohibitive, power consumption and processing capabilities become greater issues.
There is therefore a need in the art for a wireless intrusion detection system and method that overcomes the above problems by providing a non-intrusive, robust, and transparent wireless intrusion detection capability that allows a wireless access device to be located within a wireless network and quickly and accurately identifies intrusions into the wireless network.